The vulnerability resides in Unleash’s addon and integration subsystem, where the operator‑controlled url parameter is forwarded to the Addon.fetchRetry function without filtering. The weakness is a Server‑Side Request Forgery (CWE‑918). Because the URL can point to any network address, an attacker who can create or update an addon can force the server to issue requests to internal or cloud‑metadata endpoints. The server also forwards any custom headers—including Authorization, DD‑API‑KEY, and others—to the target host, thus leaking privileged request data. This remote Server‑Side Request Forgery can be used to exfiltrate sensitive information from internal services.

Affected versions are all releases of Unleash prior to 7.5.2, 7.6.5, and 8.0.2. The vendor is Unleash, the product is the Unleash feature‑management platform. Upgrading to any of the patched releases mitigates the flaw.

The CVSS score of 5.5 indicates moderate severity. No EPSS data is available and the CVE is not listed in the CISA KEV catalog. Exploitation requires an authenticated actor with the system‑level CREATE_ADDON or UPDATE_ADDON permission; with that privilege, the attacker can probe internal endpoints and exfiltrate request headers. In practice, the vulnerability is likely to be exploited within an organization’s internal network by privileged users or compromised accounts.